CVE-2017-7657
published 2018-06-26CVE-2017-7657: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled)…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
16.15%
96.6th percentile
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | jetty9 | < jetty9 9.2.25-1 (bookworm) | jetty9 9.2.25-1 (bookworm) |
| eclipse | jetty | <= 9.2.26 | — |
| eclipse | jetty | >= 9.3.0 < 9.3.24 | 9.3.24 |
| eclipse | jetty | >= 9.4.0 < 9.4.11 | 9.4.11 |
| hp | xp_p9000_command_view | >= 8.4.0-00 < 8.6.2-00 | 8.6.2-00 |
| netapp | e-series_santricity_os_controller | 11.0 – 11.50.1 | — |
| netapp | oncommand_system_manager | — | — |
| netapp | oncommand_unified_manager | < 5.2.4 | 5.2.4 |
| netapp | snap_creator_framework | < 4.3.3 | 4.3.3 |
| netapp | snapcenter | < 4.1p3 | 4.1p3 |
| netapp | snapmanager | < 3.4.2 | 3.4.2 |
| oracle | rest_data_services | — | — |
| oracle | rest_data_services | — | — |
| oracle | rest_data_services | — | — |
| oracle | rest_data_services | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| the_eclipse_foundation | eclipse_jetty | >= 9.3.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= 9.4.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= unspecified < 9.3.24 | 9.3.24 |
| the_eclipse_foundation | eclipse_jetty | >= unspecified < 9.4.11 | 9.4.11 |
| the_eclipse_foundation | eclipse_jetty | unspecified – 9.2.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP request smuggling via chunked transfer-encoding integer overflow: monitor for abnormally large chunk sizes in Transfer-Encoding: chunked requests that may be interpreted as pipelined requests by Jetty backends ↗
- →Flag HTTP requests with oversized Transfer-Encoding chunk lengths traversing intermediary proxies/load balancers destined for Jetty backends, as these may be used to smuggle unauthorized pipelined requests past authorization controls ↗
- ·CVE-2017-7657 affects Jetty 9.2.x and older (all configurations), 9.3.x (all configurations), and 9.4.x ONLY when RFC2616 compliance mode is explicitly enabled (non-default). Jetty 9.4.x in default configuration is NOT vulnerable. ↗
- ·Exploitation requires the Jetty instance to be deployed behind an intermediary (e.g., reverse proxy, WAF) that passes arbitrarily large chunk sizes through unchanged; direct exposure without such an intermediary significantly reduces exploitability. ↗
- ·Red Hat rates this as Low severity for Jetty embedded in the nutch package (Red Hat Satellite 5) because the nutch service is not exposed, making exploitation difficult. ↗
- ·Data Grid 8 is confirmed not affected. Data Grid 7 deprecated the agent-bond utility that exposes this flaw; it is disabled by default and no longer supported. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
ghsa·2018-10-19
CVE-2017-7657 [CRITICAL] CWE-190 Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
OSV
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
osv·2018-10-19
CVE-2017-7657 [CRITICAL] Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
OSV
CVE-2017-7657: In Eclipse Jetty, versions 9
osv·2018-06-26·CVSS 9.8
CVE-2017-7657 [CRITICAL] CVE-2017-7657: In Eclipse Jetty, versions 9
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Red Hat
jetty: HTTP request smuggling
vendor_redhat·2018-06-07·CVSS 9.8
CVE-2017-7657 [CRITICAL] CWE-444 jetty: HTTP request smuggling
jetty: HTTP request smuggling
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Statement: This issue affects the vers
Debian
CVE-2017-7657: jetty9 - In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4....
vendor_debian·2017·CVSS 9.8
CVE-2017-7657 [CRITICAL] CVE-2017-7657: jetty9 - In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4....
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Scope: local
bookworm: resolved (fixed in 9.2.25-1)
bullseye: resolved
No detection rules found.
No public exploits indexed.
HackerOne
Multiple HTTP Smuggling reports
hackerone·2019-11-12·CVSS 9.8
[CRITICAL] Multiple HTTP Smuggling reports
Multiple HTTP Smuggling reports
Theses reports spreads other several years and are all about **HTTP Smuggling issues**
(HTTP Requests or Responses splitting, Cache Poisoning, Security filter bypass).
I've made reports on a wide range of open source projects, explaining
the (not always easy) problems to the various security maintainers and testing the fixs.
The starting point for this work was the 2005 work published by Amit Klein and some others:
* 2004 - Amit Klein : "Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics" https://packetstormsecurity.com/papers/general/whitepaper_httpresponse.pdf
* 2005 - Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin: "HTTP Request Smuggling" https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
* 2006 -
Bugzilla
CVE-2017-7657 jetty: HTTP request smuggling
bugzilla·2018-06-27·CVSS 9.8
CVE-2017-7657 [CRITICAL] CVE-2017-7657 jetty: HTTP request smuggling
CVE-2017-7657 jetty: HTTP request smuggling
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Upstream issue:
https:/
Bugzilla
CVE-2017-7656 CVE-2017-7657 CVE-2017-7658 jetty: various flaws [fedora-all]
bugzilla·2018-06-27·CVSS 7.5
CVE-2017-7656 [HIGH] CVE-2017-7656 CVE-2017-7657 CVE-2017-7658 jetty: various flaws [fedora-all]
CVE-2017-7656 CVE-2017-7657 CVE-2017-7658 jetty: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
http://www.securitytracker.com/id/1041194https://access.redhat.com/errata/RHSA-2019:0910https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20181014-0001/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_ushttps://www.debian.org/security/2018/dsa-4278https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://www.securitytracker.com/id/1041194https://access.redhat.com/errata/RHSA-2019:0910https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20181014-0001/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_ushttps://www.debian.org/security/2018/dsa-4278https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2018-06-26
Published